locked versions of external deps